Bug 104616

Summary:	Double free or corruption
Product:	cairo	Reporter:	Uli Schlachter <psychon>
Component:	freetype font backend	Assignee:	Matthias Clasen <mclasen>
Status:	RESOLVED MOVED	QA Contact:	cairo-bugs mailing list <cairo-bugs>
Severity:	normal
Priority:	medium
Version:	unspecified
Hardware:	Other
OS:	All
Whiteboard:
i915 platform:		i915 features:

Description Uli Schlachter 2018-01-13 13:46:06 UTC

$ (make -j8 && cd test && CAIRO_TEST_TARGET=xcb DISPLAY=:2 ./cairo-test-suite a1-clip-stroke a1-clip-paint)
[...]
TESTING a1-clip-stroke
a1-clip-stroke.xcb.argb32 [0x1]:	!!!CRASHED!!!
a1-clip-stroke.xcb.rgb24 [0x1]:	double free or corruption (out)
a1-clip-stroke.xcb.rgb24 [0x1]:	!!!CRASHED!!!
a1-clip-stroke.xcb-window.rgb24 [0x1]:	double free or corruption (out)
a1-clip-stroke.xcb-window.rgb24 [0x1]:	!!!CRASHED!!!
a1-clip-stroke.xcb-window&.rgb24 [0x1]:	double free or corruption (out)
a1-clip-stroke.xcb-window&.rgb24 [0x1]:	!!!CRASHED!!!
a1-clip-stroke.xcb-render-0_0.argb32 [0x1]:	double free or corruption (out)
a1-clip-stroke.xcb-render-0_0.argb32 [0x1]:	!!!CRASHED!!!
a1-clip-stroke.xcb-render-0_0.rgb24 [0x1]:	double free or corruption (out)
a1-clip-stroke.xcb-render-0_0.rgb24 [0x1]:	!!!CRASHED!!!
a1-clip-stroke.xcb-fallback.rgb24 [0x1]:	double free or corruption (out)
a1-clip-stroke.xcb-fallback.rgb24 [0x1]:	!!!CRASHED!!!
[...]

It does not crash under valgrind. Instead, I get:

==27971== Conditional jump or move depends on uninitialised value(s)
==27971==    at 0x4C2DDD1: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==27971==    by 0x4F472DB: _cairo_ft_options_fini (cairo-ft-font.c:206)
==27971==    by 0x4F472DB: _cairo_ft_font_face_destroy (cairo-ft-font.c:3156)
==27971==    by 0x4E700A5: cairo_font_face_destroy (cairo-font-face.c:186)
==27971==    by 0x4EF1AE4: _cairo_toy_font_face_fini (cairo-toy-font-face.c:216)
==27971==    by 0x4EF1AE4: _cairo_toy_font_face_destroy (cairo-toy-font-face.c:371)
==27971==    by 0x4E700A5: cairo_font_face_destroy (cairo-font-face.c:186)
==27971==    by 0x4E717A9: _cairo_gstate_fini (cairo-gstate.c:197)
==27971==    by 0x4E6C549: _cairo_default_context_fini (cairo-default-context.c:75)
==27971==    by 0x4E6C549: _cairo_default_context_destroy (cairo-default-context.c:93)
==27971==    by 0x1292C7: cairo_test_for_target (cairo-test.c:1414)
==27971==    by 0x129FF5: _cairo_test_context_run_for_target (cairo-test.c:1555)
==27971==    by 0x1267E7: _cairo_test_runner_draw (cairo-test-runner.c:255)
==27971==    by 0x1267E7: main (cairo-test-runner.c:937)
==27971== 

Git bisect says:

commit 37f9a5525da457226317d426e06c55d77da206c1
Author: Matthias Clasen <mclasen@redhat.com>
Date:   Fri Jan 5 09:10:32 2018 -0500

    Don't leak memory in font options
    
    The cairo_font_options_t struct may now contain allocated
    memory, so call fini whenever we are about to let go of an
    embedded cairo_font_options_t struct.

This is not all that surprising and basically confirms what valgrind already said. However, at this point I'm out of ideas.

Comment 1 GitLab Migration User 2018-08-25 13:54:10 UTC

-- GitLab Migration Automatic Message --

This bug has been migrated to freedesktop.org's GitLab instance and has been closed from further activity.

You can subscribe and participate further through the new bug through this link to our GitLab instance: https://gitlab.freedesktop.org/cairo/cairo/issues/256.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.